CVE-2026-41149
Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well as 11.0.0-alpha.1 through 11.14.0, are vulnerable to HTML injection under the default configuration. Specifically, the classDef directive in Mermaid state diagrams permits DOM injection that escapes the SVG context. However, <script> tags are stripped, which prevents cross-site scripting (XSS). This issue has been fixed in versions 10.9.6 and 11.15.0. If developers are unable to immediately upgrade, they can work around this issue by setting "securityLevel": "sandbox", which prevents the issue by rendering the mermaid diagram in a sandboxed <iframe>.
| CWE | CWE-94 |
| Vendor | mermaid-js |
| Product | mermaid |
| Published | May 22, 2026 |
| Last Updated | May 23, 2026 |
Get instant alerts for mermaid-js mermaid
Be the first to know when new unknown vulnerabilities affecting mermaid-js mermaid are published — delivered to Slack, Telegram or Discord.